GitHub, Slack, SendGrid, Resend or Twilio key exposed in your app
High
Tokens for email, messaging and developer services are secrets. In a browser bundle they let anyone send email as you, post to your Slack, or access your repositories.
Why it matters
Sending a welcome email or Slack notification straight from the front end requires the key to be there, so it's a common shortcut.
Quick fix
- Revoke the token at the provider and create a new one.
- Move the call (send email, post message) to a server function.
- Store the new token as a server-only env variable.
Step by step
1. Revoke
GitHub: Settings → Developer settings → tokens. Slack: your app's OAuth page. SendGrid/Resend/Twilio: API keys page. Delete the exposed key.
2. Move server-side
Move the call that needs the key to server-side code (a Supabase Edge Function, a Vercel/Netlify function, or a Next.js API route / server action) and store the key as a server-only environment variable. In Vite apps, any variable starting with VITE_ is bundled into the browser; in Next.js, anything starting with NEXT_PUBLIC_ is.
Prompt for your AI builder
Paste this into Lovable, Bolt, v0, Cursor or Replit, then review the changes before deploying.
A third-party API token is exposed in my front-end bundle. Move every call that uses it into a server-side function that reads the token from a server-only environment variable, requires an authenticated user where appropriate, and validates input. Remove the token from all client code.FAQ
I deleted the key from my code. Am I safe now?
No. Once a key has shipped to browsers it should be treated as public. It is in old deployments, caches and anyone's saved copy of your JavaScript. Revoke it at the provider and create a new one; removing it from code only stops future leaks.